PRIVACY POLICY
HIFILAT SmartAudio Manager
Version 1.2 · In effect since: October 2026
Last updated: October 2026
This is an informational translation. The Spanish version governs (see §19).
SUMMARY
Your music is processed on your computer and never leaves it.
HIFILAT has no user accounts, no telemetry, no analytics and no advertising. Your audio files are not uploaded anywhere.
The Software does connect to the internet in specific cases, and all of them are in §5: queries to MusicBrainz and LRCLIB when you look up data or lyrics; on Mac, a sound fingerprint sent to Shazam (Apple) when Auto-tag cannot identify a song by text; the download of the HIF-IA model from Hugging Face, only if you choose to install it; and three anonymous downloads of public files from hifilat.com on launch.
If you buy a license, payment is handled by FastSpring and we receive the data needed to deliver your key (§7).
1. INTRODUCTION
This Privacy Policy describes how HIFILAT SpA ("HIFILAT", "we") handles data related to the use of the HIFILAT SmartAudio Manager software (the "Software").
This policy is aligned with:
- Law No. 19.628 on the Protection of Private Life (Chile) and Law No. 21.719 on the Protection of Personal Data (Chile), which amends it
- The General Data Protection Regulation (GDPR — Regulation (EU) 2016/679)
- The California Consumer Privacy Act (CCPA), where applicable
2. PRINCIPLES
- Minimization: only strictly necessary data is processed.
- Locality: your music is processed on your computer.
- Transparency: every network connection is documented in §5.
- User control: you decide which connected features you use.
- No commercialization: we do not sell, rent or transfer data to third parties.
3. DATA CONTROLLER
- Legal name: HIFILAT SpA
- RUT: 78.449.278-8
- Address: Antonio Bellet 193, Oficina 1210, Providencia, Santiago, Chile
- Website: https://hifilat.com
- Contact email: contacto@hifilat.com
- Jurisdiction: Republic of Chile
4. DATA THE SOFTWARE STORES ON YOUR COMPUTER
The following data is stored only on your computer. HIFILAT has no access to it: it is not synced, not backed up on our systems and not transmitted.
| Category | Examples | Where |
|---|---|---|
| Audio files | FLAC, AIFF, MP3, AAC and others | In the folders you choose |
| Audio metadata | Title, artist, album, year, genre, artwork | Inside the files (tags) |
| Lyrics | Synced (.lrc) or embedded | In .lrc files next to the song or in the tags |
| Settings | Library folders, preferences, language | config.json in the Software's data folder (macOS: ~/Library/Application Support/HIFILAT/SmartAudio/; Windows: %APPDATA%\HIFILAT\SmartAudio\) |
| License | Your activation key | license.key, in the same data folder |
| Log | Software events | hifilat.log, in the same data folder |
| Trial counter | Songs used in the usage-based trial (no personal data) | trial.json, in the same data folder |
| Metadata cache | Pre-processed metadata to speed up launch | library_index.db, in the same data folder; rebuilt automatically if deleted |
| Undo notebooks | A record of the file moves and tag changes you made (paths, old and new values), so they can be reverted | In the data folder; the last 200 operations are kept |
| Downloaded lists | revoked.json and ai-model.json (§5.5) | In the data folder |
| HIF-IA model | The language-model file (~1 GB), only if you installed it | In the data folder |
4.1 Personal data that may remain in your files or that you export
- Digitiser name (CD Ripper): when ripping a CD, the name you provide is written permanently inside each file (tags
HIFILAT_DIGITIZERandHIFILAT_SIGNATURE) to record the origin of the rip. If you use your real name and then share that file, that data travels with it. You choose which name to use. - Diagnostic report (optional): if you generate it for support, a text file is created on your Desktop. It excludes your license, your email and the content of your files, but may include the last lines of the log (which may contain file paths or names). It is not sent automatically: it only reaches us if you choose to send it.
5. NETWORK CONNECTIONS
This section is the complete list of the Software's network connections. If one is added, this policy will be updated before or together with the Software version that introduces it.
Depending on the version. Sound identification with Shazam (§5.2) and HIF-IA (§5.4) arrive with version 1.4.12. The published 1.1 versions do not have those features and do not make those connections.
| Destination | When | What leaves | How to avoid it |
|---|---|---|---|
| MusicBrainz | When you look up metadata, use Auto-tag or read a CD | Title and artist (or the CD identifier) | Don't use those features |
| Shazam (Apple) — Mac only | In Auto-tag, if HIFILAT cannot read a song's title or did not find it by text | A sound fingerprint computed on your computer. The audio does not leave. | From version 1.4.12, turn off Identify by sound in Settings; in any version, cancel Auto-tag |
| LRCLIB | When you look up lyrics | Artist, title, album and duration | Don't look up lyrics |
| Hugging Face | Only if you install HIF-IA | The model download request | Don't install HIF-IA |
| hifilat.com | When the Software opens | Nothing of yours: three public files are downloaded | See §5.5 |
| hifilat.com in your browser | When you click the HIFILAT.COM link or "Buy" | A normal web visit, in your browser | Don't click them |
In all cases the destination service sees your IP address, as with any internet connection.
5.1 MusicBrainz (https://musicbrainz.org)
When it connects: when you click "Look up metadata" in the editor, when you use Auto-tag, and when a physical CD is detected (disc-identifier lookup).
What is sent:
- The song's title and artist, or the CD identifier.
- A Software identifier (User-Agent) required by MusicBrainz, with a contact email. By default it is HIFILAT's email (contacto@hifilat.com), not yours. Your email is only sent if you set it in Settings → Advanced → Email for MusicBrainz.
- Your IP address.
What is NOT sent: your audio files, your full library or identifiers of your computer. The song's duration is compared on your computer, not sent.
MusicBrainz privacy policy: https://metabrainz.org/privacy
5.2 Shazam (Apple), through ShazamKit — Mac only
When it connects: only inside Auto-tag, and only in two cases: when HIFILAT cannot read a title in the song (or the only one it finds comes from the file name), or when it was not found by text on MusicBrainz. Before starting, the Software tells you on screen that it may listen to the song and send a fingerprint to Shazam, and you can cancel. Some test builds before 1.4.12, given only to testers, wrongly said in that notice that no sound fingerprint left: one did, in the two cases described. In those builds, if you do not want a fingerprint to leave, cancel Auto-tag.
How to turn it off: from version 1.4.12, in Settings → Identify by sound. With that option off, Auto-tag works by text only, neither of the two cases above sends a fingerprint, and there is no connection to Shazam.
How it works: HIFILAT listens to a few seconds of the song on your computer and computes, using Apple's ShazamKit technology, a sound fingerprint: a numeric summary used to recognize the song. Only that fingerprint is sent to Apple's Shazam catalog.
What is NOT sent: the audio file. The audio never leaves your computer, and the fingerprint is not the audio nor can it be listened to.
What happens with the answer: what Shazam returns (title and artist) is used only as a key to search MusicBrainz. The tags written to your files always come from MusicBrainz, never from Shazam.
Apple privacy policy: https://www.apple.com/legal/privacy/
5.3 LRCLIB (https://lrclib.net)
When it connects: when you click "Look up lyrics" in the editor's Lyrics tab.
What is sent: the song's artist, title, album and duration; the Software identifier; your IP address.
What is NOT sent: audio files or other metadata.
5.4 Hugging Face (https://huggingface.co) — HIF-IA model download
When it connects: only if you choose to install HIF-IA, the Software's assistant. Before downloading, the Software shows you the size (~1 GB) and asks for confirmation.
What is sent: the model-file download request and your IP address. No data of yours. The downloaded file is verified with a cryptographic fingerprint before use.
Once installed: HIF-IA runs on your computer. The questions you ask it and the answers it gives are not sent anywhere.
Hugging Face privacy policy: https://huggingface.co/privacy
5.5 The three automatic downloads on launch
When the Software opens, three public files are downloaded from hifilat.com. All three are downloads: no data of yours is sent in any of them — personal, identifying or usage. It is not telemetry. The only thing the server sees is your IP address, as with any web request.
| File | Purpose | Can it be turned off? |
|---|---|---|
version.json | Compare your version with the latest published one | Yes, in Settings → Check for updates |
revoked.json | The list of license keys disabled for having been shared publicly | No |
ai-model.json | Where to download the HIF-IA model from, if you ever install it | No |
Why two cannot be turned off. The revoked-keys list protects the license you paid for from anyone who shares it; a switch that turns it off makes it useless. And the HIF-IA model location must be able to change without forcing you to update the Software. Both are anonymous, signed downloads of a public file, and both fail silently: offline, the Software works exactly the same.
If you prefer the Software not to talk to the internet at all, a firewall blocking hifilat.com does not remove any local feature.
5.6 Links you open
The HIFILAT.COM link and the "Buy" button open our website in your browser. They send no data of yours; it is a normal web visit, governed by the Website Privacy Policy (https://hifilat.com/en/privacidad-sitio/).
6. WHAT THE SOFTWARE DOES NOT DO
- It has no telemetry, analytics, automatic crash reporting, advertising or trackers.
- It has no user accounts and no cloud sync.
- It does not upload your audio files anywhere.
- It does not install updates on its own: at most it notifies you of a new version (§5.5), and that can be turned off.
- The license is validated on your computer. The only related download is the public revoked-keys list (§5.5); your key is not sent.
You can check this by inspecting network traffic with tools such as Little Snitch or Wireshark.
7. BUYING THE LICENSE
Who sells. The license is sold through FastSpring (Bright Market, LLC, United States), which acts as seller (Merchant of Record): it processes payment, collects the taxes applicable in your country and handles refunds. FastSpring processes your payment data under its own policy (https://fastspring.com/privacy/). HIFILAT neither sees nor stores your card details.
What we receive from FastSpring: your name, your email address, your country and the order details.
What we use them for: to issue and send you your license key, re-send it if you lose it, assist you with support and refunds, and meet our accounting and tax obligations.
How long we keep them: while your license is in force and for the period required by Chilean tax law.
Windows and the Microsoft Store. On Windows, the Software is downloaded free from the Microsoft Store, which processes its own data under Microsoft's privacy policy. The license is still purchased through FastSpring.
8. LEGAL BASIS FOR PROCESSING
- Performance of the contract: providing the Software, and processing your purchase and the delivery of your key (§7).
- Consent: queries to MusicBrainz, LRCLIB and Shazam, and the HIF-IA model download. You start them, with the information shown on screen.
- Legitimate interest: the three anonymous downloads on launch (§5.5), which protect licenses and notify you of new versions without processing any data of yours beyond the IP; and the local error log, which you control.
- Legal obligation: retaining the purchase data required by tax law.
9. COOKIES AND SIMILAR TECHNOLOGIES
The Software is a desktop application. It uses no tracking cookies, web beacons, advertising identifiers or similar technologies. Its interface may store technical data for the local session, which is not transmitted to HIFILAT.
10. DATA RETENTION
| Data | Retention |
|---|---|
| Audio files and metadata | Indefinite, under your control |
| Settings, license, log, trial counter, cache | Until you delete them or uninstall the Software |
| Undo notebooks | The last 200 operations; you can delete them |
| HIF-IA model | Until you uninstall it |
| Data sent to MusicBrainz, LRCLIB, Apple (Shazam) and Hugging Face | Under each service's policy |
| Purchase data (§7) | While the license is in force and for the period required by tax law |
| Emails you send us | Until your query is resolved, then for a reasonable follow-up period |
The only personal data HIFILAT keeps on its own systems is purchase data (§7) and what you send us by email.
11. SECURITY
The Software implements these measures to protect your data:
- Local-only server: the internal server listens only on
127.0.0.1; it is not reachable from the network. - Path protection: strict validation to prevent access to files outside the authorized folders.
- Injection protection: escaping of all external data in the interface and in system dialogs.
- Limits on external processes: ffmpeg and other subprocesses have a maximum run time.
- Signed downloads: the
hifilat.comlists and the HIF-IA model are verified before use.
We recommend keeping your operating system up to date and backing up your music regularly.
12. YOUR RIGHTS
You have the right to access, rectify, erase and object to the processing of your data, to portability and to withdraw your consent.
- Data on your computer: you control it directly. You can open, edit or delete it whenever you want; it is in open formats (JSON, text, FLAC).
- Data HIFILAT does keep (purchase data and emails you send us): write to contacto@hifilat.com. We will respond within the timeframes required by applicable law.
- Data sent to third parties (MusicBrainz, LRCLIB, Apple, Hugging Face, FastSpring): contact each service, under its policy.
Complaint to the authority: in Chile you also have the right to complain to the Personal Data Protection Agency (Agencia de Protección de Datos Personales), created by Law No. 21.719.
Automated decisions and profiling: HIFILAT does not make automated decisions or profile users.
13. MINORS
The Software is not directed at minors. If you are under 18 (or a minor under the law of your country), you should use it under the supervision of a responsible adult. We do not knowingly collect personal data from minors.
14. INTERNATIONAL TRANSFERS
Some connections involve data leaving Chile:
- MusicBrainz: servers in Europe and the United States.
- LRCLIB: servers outside Chile.
- Apple (Shazam): United States.
- Hugging Face: United States.
- FastSpring: United States.
- Our email provider (if you write to us): servers outside Chile.
These transfers occur when you use the corresponding feature or buy a license, and each service has its own data-protection safeguards.
Website and newsletter: if you contact us through the website form or subscribe to the newsletter, that processing is governed by the Website Privacy Policy (https://hifilat.com/en/privacidad-sitio/), which complements this one.
15. SECURITY INCIDENTS
If we become aware of a security vulnerability in the Software, we will publish a notice at https://hifilat.com, release a fix as quickly as possible and, if the impact is material, notify users through the available channels.
If you discover a vulnerability, please report it responsibly to contacto@hifilat.com before making it public.
16. CHANGES TO THIS POLICY
This policy may be updated. Each version states its number and date at the top. Changes will be published at https://hifilat.com and notified within the Software when material. If the Software adds a new network connection, this policy will be updated before or together with that version.
17. CONTACT
- Email: contacto@hifilat.com
- Web: https://hifilat.com
18. APPLICABLE LAW
HIFILAT strives to comply with applicable data-protection laws, including:
- Chile: Law No. 19.628 on the Protection of Private Life and Law No. 21.719 on the Protection of Personal Data. This policy is structured to meet their duty to inform and includes the right to complain to the Personal Data Protection Agency.
- European Union: GDPR, Regulation (EU) 2016/679.
- United States: CCPA, California Consumer Privacy Act.
- Argentina: Law 25.326 on the Protection of Personal Data.
- Brazil: LGPD, Lei Geral de Proteção de Dados.
In jurisdictions with stricter rules, the provisions most protective of the user prevail.
19. LANGUAGE
The original version of this policy is written in Spanish. Any translation is provided for information only; in the event of a discrepancy, the Spanish version prevails.
© 2025–2026 HIFILAT SpA. All rights reserved.